libxposed is now under RFC. We are planning the final version of the api, which is the last breaking change before publishing to MavenCentral. Please post issues if you have any suggestion or question.
See https://github.com/libxposed/api/pull/51
See https://github.com/libxposed/api/pull/51
GitHub
RFC for final stable API by Dr-TSNG · Pull Request #51 · libxposed/api
After the merge, the release will be prepared for MavenCentral, and no further breaking changes are permitted.
Key changes
API Version
The API constant (value 100) has been removed. Use the new ge...
Key changes
API Version
The API constant (value 100) has been removed. Use the new ge...
🔥51❤24👏4🥰1
Forwarded from LSPosed Internal Test
We are finalizing the draft. Here's the full breaking change logs:
https://github.com/libxposed/api/pull/51#issue-3970278302
https://github.com/libxposed/api/pull/51#issue-3970278302
GitHub
RFC for final stable API by Dr-TSNG · Pull Request #51 · libxposed/api
After the merge, the release will be prepared for MavenCentral, and no further breaking changes are permitted.
Key changes
API Version
The API constant (value 100) has been removed. Use the new ge...
Key changes
API Version
The API constant (value 100) has been removed. Use the new ge...
❤55🙏12🥰5🤡2❤🔥1👍1
Forwarded from 南宫雪珊
fastboot oem set-gpu-preemption-value 0 androidboot.selinux=permissive
service call miui.mqsas.IMQSNative 21 i32 1 s16 "命令" i32 1 s16 "参数列表" s16 '输出路径' i32 600
第一个漏洞可以关闭SELinux强制执行，高通限定，已修复；第二个漏洞以root身份执行任意命令，小米限定，未修复。组合后是完整root权限。
service call miui.mqsas.IMQSNative 21 i32 1 s16 "命令" i32 1 s16 "参数列表" s16 '输出路径' i32 600
第一个漏洞可以关闭SELinux强制执行，高通限定，已修复；第二个漏洞以root身份执行任意命令，小米限定，未修复。组合后是完整root权限。
GitLab
QcomModulePkg: Fix propagation of untrusted input into kernel cmdline (fb8e8642) · Commits · CodeLinaro / la / abl / tianocore…
First lets set the size to prevent any double-fetch in the getVariable. Then limit any input to either 1 or 0. Change-Id: I449f74ddefcec665f4e0ea4ed538f892dfb14e21 (cherry picked from commit 92a20dbc895a53618b28cfd4090cb49a32683ad8)
1❤26🔥2🤡2
Forwarded from 南宫雪珊
南宫雪珊
fastboot oem set-gpu-preemption-value 0 androidboot.selinux=permissive service call miui.mqsas.IMQSNative 21 i32 1 s16 "命令" i32 1 s16 "参数列表" s16 '输出路径' i32 600 第一个漏洞可以关闭SELinux强制执行，高通限定，已修复；第二个漏洞以root身份执行任意命令，小米限定，未修复。组合后是完整root权限。
https://github.com/hicode002/qualcomm_gbl_exploit_poc
第三个漏洞，永久解锁bootloader，高通限定，未修复。要求把 gbl_efi_unlock.efi 写入 efisp 分区，这需要root权限，嗯……
解锁会丢失全部数据，但不用担心升级系统会修复漏洞，另外记得还原efisp分区。
第三个漏洞，永久解锁bootloader，高通限定，未修复。要求把 gbl_efi_unlock.efi 写入 efisp 分区，这需要root权限，嗯……
解锁会丢失全部数据，但不用担心升级系统会修复漏洞，另外记得还原efisp分区。
GitHub
GitHub - kasnria001/qualcomm_gbl_exploit_poc: Unlocking qualcomm bootloader via gbl exploit.
Unlocking qualcomm bootloader via gbl exploit. Contribute to kasnria001/qualcomm_gbl_exploit_poc development by creating an account on GitHub.
❤🔥29❤13🤡2
Forwarded from 南宫雪珊
南宫雪珊
fastboot oem set-gpu-preemption-value 0 androidboot.selinux=permissive service call miui.mqsas.IMQSNative 21 i32 1 s16 "命令" i32 1 s16 "参数列表" s16 '输出路径' i32 600 第一个漏洞可以关闭SELinux强制执行，高通限定，已修复；第二个漏洞以root身份执行任意命令，小米限定，未修复。组合后是完整root权限。
第一个洞还有更多利用类型
虽然已修复，但这是2022年引入的老漏洞了，应该适用于更多高通soc。
另外，对于selinux宽容的系统，即使不是小米，也可以利用隔离服务提权到root： https://github.com/vvb2060/Magica
fastboot oem set-hw-fence-value 0 androidboot.selinux=permissive
虽然已修复，但这是2022年引入的老漏洞了，应该适用于更多高通soc。
另外，对于selinux宽容的系统，即使不是小米，也可以利用隔离服务提权到root： https://github.com/vvb2060/Magica
GitLab
QcomModulePkg: add check for set-hw-fence-value command (78297e8c) · Commits · CodeLinaro / la / abl / tianocore / edk2 · GitLab
Add check to ensure that only 0/1 can be passed to the 'fastboot oem set-hw-fence-value 1' command. Change-Id: I7c4b8eb87264cf5afcb355336908b1b430875aee (cherry picked from commit 170b1d75ee3c11fa73884c6fbf70c51ffeeee1b3)
❤62🤡2
libxposed API 101 已定稿。待模块开发者测试无误后，将发布到 MavenCentral。
稍后我们将发布兼容性单元测试工具供第三方实现参考。
参考开发文档：
https://libxposed.github.io/api/
https://libxposed.github.io/service/
相比 API 100 变更记录
稍后我们将发布兼容性单元测试工具供第三方实现参考。
参考开发文档：
https://libxposed.github.io/api/
https://libxposed.github.io/service/
相比 API 100 变更记录
GitHub
RFC for final stable API by Dr-TSNG · Pull Request #51 · libxposed/api
After the merge, the release will be prepared for MavenCentral, and no further breaking changes are permitted.
Key changes
API Version
The API constant (value 100) has been removed. Use the new ge...
Key changes
API Version
The API constant (value 100) has been removed. Use the new ge...
3❤91🤡22👍11🔥9🥰4👎1🫡1💊1
Forwarded from 5ec1cff (5ec1cff)
Zygisk-Next-1.3.3-731-1193e46-release.zip
5.4 MB
ZygiskNext 1.3.3 正式版
默认启用 ZN linker
适配 Android Canary 2603 的相关改动
提升对 nubia 系统、三星系统的兼容性
修复某些情况下与 magisk 的兼容性问题
修复其他小问题
ZygiskNext 1.3.3 Stable Release
Enable ZN linker by default
Adapt to changes in Android Canary 2603
Improve compatibility with certain nubia and Samsung systems
Fix compatibility issues with Magisk in some cases
Fix other minor issues
SHA256: a528584874dd814423dece1a6bc734aee524886d74f4453f48af0715a7f0f5c4
real5ec1cff | Github
默认启用 ZN linker
适配 Android Canary 2603 的相关改动
提升对 nubia 系统、三星系统的兼容性
修复某些情况下与 magisk 的兼容性问题
修复其他小问题
ZygiskNext 1.3.3 Stable Release
Enable ZN linker by default
Adapt to changes in Android Canary 2603
Improve compatibility with certain nubia and Samsung systems
Fix compatibility issues with Magisk in some cases
Fix other minor issues
SHA256: a528584874dd814423dece1a6bc734aee524886d74f4453f48af0715a7f0f5c4
real5ec1cff | Github
2❤102👍18🥰12🤡4💊2👏1🤪1
Forwarded from 5ec1cff (5ec1cff)
Zygisk-Next-1.3.4-746-d1b76b3-release.zip
5.4 MB
ZygiskNext 1.3.4 正式版
修复使用某些模块导致崩溃的问题
WebUI 增加 ZN 模块列表
增加 Zygisk 模块错误检查机制，发现存在问题的模块会显示在 ZN 的模块状态和 WebUI 中（可检查的错误请参见文档）
补充 1.3.3 的更新：ZN 模块的 inline hook 功能无需额外在 sepolicy 增加 execmem 规则
ZygiskNext 1.3.4 Stable Release
Fixed an issue that caused crashes when using certain modules.
Add ZN module list to the WebUI.
Add Zygisk module error checking mechanism. Modules with issues will be displayed in ZN's module status and WebUI (see the documentation for checkable errors).
Supplemented the 1.3.3 update: ZN module inline hook functionality no longer requires adding an execmem rule to sepolicy.
SHA256: b330b368e6133b83c069c0ff1bb1bf81091afec5a8d6532d39c14bd1b7e5d367
real5ec1cff | Github
修复使用某些模块导致崩溃的问题
WebUI 增加 ZN 模块列表
增加 Zygisk 模块错误检查机制，发现存在问题的模块会显示在 ZN 的模块状态和 WebUI 中（可检查的错误请参见文档）
补充 1.3.3 的更新：ZN 模块的 inline hook 功能无需额外在 sepolicy 增加 execmem 规则
ZygiskNext 1.3.4 Stable Release
Fixed an issue that caused crashes when using certain modules.
Add ZN module list to the WebUI.
Add Zygisk module error checking mechanism. Modules with issues will be displayed in ZN's module status and WebUI (see the documentation for checkable errors).
Supplemented the 1.3.3 update: ZN module inline hook functionality no longer requires adding an execmem rule to sepolicy.
SHA256: b330b368e6133b83c069c0ff1bb1bf81091afec5a8d6532d39c14bd1b7e5d367
real5ec1cff | Github
1🔥63❤39👍10🥰4